Databases in the Cloud

Cloud Platform Fundamentals

Chapter 7 · Databases in the Cloud

Deliberately brief, by design: this chapter doesn't re-teach SQL or NoSQL query writing — this site's own mysql2/mysql3 and mongodb1/mongodb2 courses already cover that in real depth. This chapter is specifically about what changes when a database becomes a managed cloud service rather than something installed and operated by hand.

What "Managed" Actually Means for a Database

A managed database service sits at the PaaS layer of Chapter 1's IaaS/PaaS/SaaS spectrum, even when it's used alongside plain IaaS compute elsewhere in the same architecture. The provider handles patching, backup scheduling, replication setup, and failover — but per Chapter 1's shared responsibility model, schema design, query writing, and the data itself remain entirely the customer's responsibility.

Managed Relational Databases

RDS (AWS), Azure SQL Database, and Cloud SQL (GCP) run the exact same database engines already covered elsewhere on this site — MySQL, PostgreSQL, SQL Server — just operated by the provider. This has a genuinely direct practical consequence: every bit of mysql2/mysql3's SQL knowledge transfers completely unchanged. Only the operational layer changes — who handles backups, patching, and scaling — not the query language or schema design underneath.

Two genuinely useful managed features: automated backups with point-in-time recovery, and Multi-AZ/high-availability deployments — a standby replica maintained in a different availability zone (Chapter 5), with automatic failover if the primary instance fails.

Managed NoSQL Databases

DynamoDB (AWS), Cosmos DB (Azure), and Firestore (GCP) are not simply "MongoDB, but managed." DynamoDB and Cosmos DB are each proprietary services with their own distinct data models and APIs — though Cosmos DB does offer a genuine MongoDB-compatible API mode worth knowing about. Firestore is Google's own document-database service, conceptually close to mongodb1-1's document model (documents, collections, embedding vs. referencing) but not the same product or API as MongoDB itself.

The document-model concepts from mongodb1-1 — schema flexibility, embedding vs. referencing trade-offs — remain broadly useful thinking tools across all of these services, even though the specific query API differs from provider to provider.

Read Replicas & Scaling Reads

A read replica is a read-only copy of a database used to offload read traffic away from the primary instance handling writes — a scaling tool. This is genuinely easy to confuse with the Multi-AZ/HA standby replica described above, which exists specifically for failover, not scaling, even though the underlying replication mechanism is often similar. A standby typically isn't meant to serve regular application read traffic; a read replica typically isn't automatically promoted on primary failure the way an HA standby is. Some providers do offer configurations blending both roles — but the two purposes are distinct by default and worth keeping separate.

Connection Management — A Common Support Issue

"Connection refused" and "too many connections" are genuinely frequent real tickets, usually from one of two causes:

  • Connection pool exhaustion — a managed database instance has a maximum connection limit based on its size. An application opening connections without properly pooling or closing them can exhaust that limit, causing failures for other legitimate connections too, not just its own.
  • A blocking security group — directly echoing Chapter 5's networking chapter: a database sitting in a private subnet, unreachable from outside it, is very often working exactly as designed, not broken.
Never make a database publicly reachable to "fix" a connectivity test
A database that's unreachable because it's correctly placed in a private subnet (Chapter 5) should stay that way. The correct fix for needing occasional external access is a bastion host, a VPN connection, or an application-tier proxy — never opening the database directly to the public internet, which trades a minor testing inconvenience for a serious, ongoing security regression.

Choosing Managed vs. Self-Managed on a VM

Managed is the right default recommendation most of the time — less operational burden, at the cost of somewhat less control and sometimes fewer configuration options or supported engine versions. Self-managing a database on a plain VM (Chapter 3) makes sense specifically when a required configuration, extension, or engine version genuinely isn't supported by the managed offering — a real, occasionally legitimate reason, not simply a preference for more control.

Where the actual query-writing knowledge lives
This chapter deliberately stays at the operational/service layer. For the SQL and schema-design knowledge itself, this site's own mysql2/mysql3 courses cover relational databases in depth, and mongodb1/mongodb2 cover the document model — all of it applies directly on top of whatever this chapter's managed service is running underneath.

Hands-On Exercises

Exercise 1

An organization migrates a self-hosted MySQL database to a managed RDS/Cloud SQL/Azure SQL instance. Explain what changes and what stays the same, and specifically which existing SQL knowledge continues to apply directly, unchanged.

📄 View solution
Exercise 2

Distinguish a read replica from a Multi-AZ/HA standby replica — what each is actually for, and whether one can also serve the other's purpose by default.

📄 View solution
Exercise 3

A customer says: "I can't connect to my database from my laptop, so let's just make it publicly accessible temporarily to test." Explain why this is a bad idea, and what the correct troubleshooting/access approach should be instead.

📄 View solution

Chapter 7 Quick Reference

  • Managed = PaaS layer for the database — provider handles patching/backups/failover, customer still owns schema/queries/data
  • RDS/Azure SQL/Cloud SQL run the same MySQL/PostgreSQL/SQL Server engines — all mysql2/mysql3 SQL knowledge transfers unchanged
  • DynamoDB/Cosmos DB/Firestore are not "managed MongoDB" — distinct proprietary APIs, though Cosmos DB offers a MongoDB-compatible mode
  • Read replicas (scaling reads) ≠ Multi-AZ/HA standby (failover) — easy to confuse, distinct default purposes
  • "Connection refused"/"too many connections" — usually pool exhaustion or a security group blocking the port, not a broken database
  • Never expose a database publicly to work around a private-subnet connectivity issue — use a bastion host, VPN, or app-tier proxy instead
  • Next chapter: Monitoring & Logging — CloudWatch/Azure Monitor/Cloud Monitoring, log aggregation, and alerting basics